Commit 132328e8 authored by Florian Westphal's avatar Florian Westphal Committed by Andrii Nakryiko
Browse files

bpf: netfilter: Add BPF_NETFILTER bpf_attach_type 



Andrii Nakryiko writes:

 And we currently don't have an attach type for NETLINK BPF link.
 Thankfully it's not too late to add it. I see that link_create() in
 kernel/bpf/syscall.c just bypasses attach_type check. We shouldn't
 have done that. Instead we need to add BPF_NETLINK attach type to enum
 bpf_attach_type. And wire all that properly throughout the kernel and
 libbpf itself.

This adds BPF_NETFILTER and uses it.  This breaks uabi but this
wasn't in any non-rc release yet, so it should be fine.

v2: check link_attack prog type in link_create too

Fixes: 84601d6e ("bpf: add bpf_link support for BPF_NETFILTER programs")
Suggested-by: default avatarAndrii Nakryiko <andrii.nakryiko@gmail.com>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/CAEf4BzZ69YgrQW7DHCJUT_X+GqMq_ZQQPBwopaJJVGFD5=d5Vg@mail.gmail.com/
Link: https://lore.kernel.org/bpf/20230605131445.32016-1-fw@strlen.de
parent 23509e92

include/uapi/linux/bpf.h

+1 −0
Original line number Diff line number Diff line
@@ -1035,6 +1035,7 @@ enum bpf_attach_type { 
	BPF_TRACE_KPROBE_MULTI,

	BPF_LSM_CGROUP,

	BPF_STRUCT_OPS,

	BPF_NETFILTER,

	__MAX_BPF_ATTACH_TYPE

};

kernel/bpf/syscall.c

+9 −0
Original line number Diff line number Diff line
@@ -2433,6 +2433,10 @@ bpf_prog_load_check_attach(enum bpf_prog_type prog_type, 
		default:

			return -EINVAL;

		}

	case BPF_PROG_TYPE_NETFILTER:

		if (expected_attach_type == BPF_NETFILTER)

			return 0;

		return -EINVAL;

	case BPF_PROG_TYPE_SYSCALL:

	case BPF_PROG_TYPE_EXT:

		if (expected_attach_type)
@@ -4590,7 +4594,12 @@ static int link_create(union bpf_attr *attr, bpfptr_t uattr) 


	switch (prog->type) {

	case BPF_PROG_TYPE_EXT:

		break;

	case BPF_PROG_TYPE_NETFILTER:

		if (attr->link_create.attach_type != BPF_NETFILTER) {

			ret = -EINVAL;

			goto out;

		}

		break;

	case BPF_PROG_TYPE_PERF_EVENT:

	case BPF_PROG_TYPE_TRACEPOINT:

tools/include/uapi/linux/bpf.h

+1 −0
Original line number Diff line number Diff line
@@ -1035,6 +1035,7 @@ enum bpf_attach_type { 
	BPF_TRACE_KPROBE_MULTI,

	BPF_LSM_CGROUP,

	BPF_STRUCT_OPS,

	BPF_NETFILTER,

	__MAX_BPF_ATTACH_TYPE

};

tools/lib/bpf/libbpf.c

+2 −1
Original line number Diff line number Diff line
@@ -117,6 +117,7 @@ static const char * const attach_type_name[] = { 
	[BPF_PERF_EVENT]		= "perf_event",

	[BPF_TRACE_KPROBE_MULTI]	= "trace_kprobe_multi",

	[BPF_STRUCT_OPS]		= "struct_ops",

	[BPF_NETFILTER]			= "netfilter",

};



static const char * const link_type_name[] = {
@@ -8712,7 +8713,7 @@ static const struct bpf_sec_def section_defs[] = { 
	SEC_DEF("struct_ops+",		STRUCT_OPS, 0, SEC_NONE),

	SEC_DEF("struct_ops.s+",	STRUCT_OPS, 0, SEC_SLEEPABLE),

	SEC_DEF("sk_lookup",		SK_LOOKUP, BPF_SK_LOOKUP, SEC_ATTACHABLE),

	SEC_DEF("netfilter",		NETFILTER, 0, SEC_NONE),

	SEC_DEF("netfilter",		NETFILTER, BPF_NETFILTER, SEC_NONE),

};



static size_t custom_sec_def_cnt;

tools/lib/bpf/libbpf_probes.c

+2 −0
Original line number Diff line number Diff line
@@ -180,7 +180,9 @@ static int probe_prog_load(enum bpf_prog_type prog_type, 
	case BPF_PROG_TYPE_SK_REUSEPORT:

	case BPF_PROG_TYPE_FLOW_DISSECTOR:

	case BPF_PROG_TYPE_CGROUP_SYSCTL:

		break;

	case BPF_PROG_TYPE_NETFILTER:

		opts.expected_attach_type = BPF_NETFILTER;

		break;

	default:

		return -EOPNOTSUPP;